Merged
Conversation
Add a standalone Iroh relay bootstrap server for dev testing. Uses Podman Quadlet for native systemd container management, Cloudflare for DNS provisioning via Pulumi, and certbot with a retry loop for TLS.
Collaborator
🍹
|
|
No actionable comments were generated in the recent review. 🎉 ℹ️ Recent review info⚙️ Run configurationConfiguration used: Organization UI Review profile: CHILL Plan: Pro Run ID: 📒 Files selected for processing (2)
✅ Files skipped from review due to trivial changes (1)
🚧 Files skipped from review as they are similar to previous changes (1)
WalkthroughAdds Pulumi and cloud-init artifacts to provision a DigitalOcean Droplet running an Iroh bootstrap relay, create Cloudflare DNS A/AAAA records, introduce Cloudflare Pulumi config keys, add a cloud-init schema lint step in CI, and document the new deployment and operations. Changes
Estimated code review effort🎯 3 (Moderate) | ⏱️ ~25 minutes Possibly related PRs
🚥 Pre-merge checks | ✅ 2 | ❌ 1❌ Failed checks (1 warning)
✅ Passed checks (2 passed)
✏️ Tip: You can configure your own custom pre-merge checks in the settings. ✨ Finishing Touches🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
mattyg
previously approved these changes
Mar 25, 2026
jost-s
previously approved these changes
Mar 25, 2026
Align naming with existing convention where "bootstrap2" refers to the Kitsune2 bootstrap protocol version.
ThetaSinner
force-pushed
the
feat/dev-test-iroh
branch
from
9c0fb13 to
79ab470
Compare
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 3
🧹 Nitpick comments (2)
main.go (1)
84-92: Extract duplicated SSH-key lookup into a helper.The same
GetSshKeys+ fingerprint mapping appears in multiple deployment functions; pulling it into one helper will reduce drift and simplify future changes.🤖 Prompt for AI Agents
Verify each finding against the current code and only fix it if needed. In `@main.go` around lines 84 - 92, Extract the duplicated DigitalOcean SSH-key lookup into a helper: create a function (e.g., fetchSshFingerprints or GetSshFingerprints) that calls digitalocean.GetSshKeys(ctx, &digitalocean.GetSshKeysArgs{}, nil), handles the error, and returns the []string of key.Fingerprint; then replace the repeated blocks that declare getSshKeysResult, err and build sshFingerprints with calls to this helper, preserving the context variable name (ctx) and error handling pattern used by callers..github/workflows/preview.yaml (1)
24-31: Consider de-duplicating cloud-init lint steps.The new block duplicates existing parsing/annotation logic; this is likely to drift again. A small reusable script/composite action with a file argument would reduce maintenance risk.
🤖 Prompt for AI Agents
Verify each finding against the current code and only fix it if needed. In @.github/workflows/preview.yaml around lines 24 - 31, Duplicate cloud-init lint/parsing logic in the "Lint dev-test-bootstrap2-iroh cloud-init file" step should be consolidated into a reusable script or composite action that accepts the cloud-init file path; extract the pipeline of "cloud-init schema -c <file> 2> >(tee stderr.log) >> $GITHUB_STEP_SUMMARY" plus the subsequent grep/sed annotation (the stderr.log -> grep 'in.*line.*column' ... sed 's/...::error .../') into a single script or action, commit that script (e.g., scripts/lint-cloud-init.sh) and replace the duplicated step body with a call that passes the file argument (dev-test-bootstrap2-iroh/cloud-init.yaml) so all uses of cloud-init schema, stderr.log, the grep filter, and the ::error sed formatter are centralized and reused.
🤖 Prompt for all review comments with AI agents
Verify each finding against the current code and only fix it if needed.
Inline comments:
In @.github/workflows/preview.yaml:
- Line 29: The CI annotation is hardcoding file=cloud-init.yaml in the sed
replacement, preventing clickable diagnostics for other files; update the sed
replacement in the grep/sed pipeline (the command that pipes stderr.log through
grep and sed) to use the captured filename group (\2) for the file= value and in
the title if desired so the annotation becomes file=\2,line=\3,col=\4 with the
message/title using \1 and \2 as needed.
In `@dev-test-bootstrap2-iroh/cloud-init.yaml`:
- Around line 44-46: The bootstrap service is started but not enabled, so it
won't persist across reboots; update the cloud-init commands around the
"systemctl start bootstrap" invocation to enable the service as well (e.g., use
"systemctl enable --now bootstrap" or run "systemctl enable bootstrap" before
starting) so the "bootstrap" service is enabled on boot and will survive host
reboots while keeping the final "exit 0".
- Around line 37-50: The retry window for obtaining the certificate is too short
(max_attempts and delay) causing premature failure; update the certbot retry
loop (the for loop that iterates using max_attempts and delay around the certbot
certonly command) to increase max_attempts (e.g., to allow 30+ minutes) and
implement exponential backoff (multiply delay each attempt and add optional
jitter) so DNS propagation has more time before giving up, and only call
systemctl start bootstrap/exit 0 after a successful certbot run.
---
Nitpick comments:
In @.github/workflows/preview.yaml:
- Around line 24-31: Duplicate cloud-init lint/parsing logic in the "Lint
dev-test-bootstrap2-iroh cloud-init file" step should be consolidated into a
reusable script or composite action that accepts the cloud-init file path;
extract the pipeline of "cloud-init schema -c <file> 2> >(tee stderr.log) >>
$GITHUB_STEP_SUMMARY" plus the subsequent grep/sed annotation (the stderr.log ->
grep 'in.*line.*column' ... sed 's/...::error .../') into a single script or
action, commit that script (e.g., scripts/lint-cloud-init.sh) and replace the
duplicated step body with a call that passes the file argument
(dev-test-bootstrap2-iroh/cloud-init.yaml) so all uses of cloud-init schema,
stderr.log, the grep filter, and the ::error sed formatter are centralized and
reused.
In `@main.go`:
- Around line 84-92: Extract the duplicated DigitalOcean SSH-key lookup into a
helper: create a function (e.g., fetchSshFingerprints or GetSshFingerprints)
that calls digitalocean.GetSshKeys(ctx, &digitalocean.GetSshKeysArgs{}, nil),
handles the error, and returns the []string of key.Fingerprint; then replace the
repeated blocks that declare getSshKeysResult, err and build sshFingerprints
with calls to this helper, preserving the context variable name (ctx) and error
handling pattern used by callers.
ℹ️ Review info
⚙️ Run configuration
Configuration used: Organization UI
Review profile: CHILL
Plan: Pro
Run ID: d8ba7aff-5b7f-4411-9c83-31fe495a03d5
⛔ Files ignored due to path filters (1)
go.sumis excluded by!**/*.sum
📒 Files selected for processing (6)
.github/workflows/preview.yamlPulumi.network-services.yamlREADME.mddev-test-bootstrap2-iroh/cloud-init.yamlgo.modmain.go
.github/workflows/preview.yaml
Outdated
| if ! cloud-init schema -c dev-test-bootstrap2-iroh/cloud-init.yaml 2> >(tee stderr.log) >> $GITHUB_STEP_SUMMARY | ||
| then | ||
| # Print errors as such in GitHub logs. | ||
| cat stderr.log | grep "in.*line.*column" -B1 -A1 --no-group-separator | sed -z 's/\([^\n]*\)\n\s*in "\([^"]*\)", line \([[:digit:]]\+\), column \([[:digit:]]\+\):\s*/::error file=cloud-init.yaml,title=\1 in \2,line=\3,col=\4::/g' |
There was a problem hiding this comment.
Use the actual file path in CI error annotations.
On Line 29, the annotation still uses file=cloud-init.yaml; this breaks clickable diagnostics for this new target file.
🔧 Proposed fix
- cat stderr.log | grep "in.*line.*column" -B1 -A1 --no-group-separator | sed -z 's/\([^\n]*\)\n\s*in "\([^"]*\)", line \([[:digit:]]\+\), column \([[:digit:]]\+\):\s*/::error file=cloud-init.yaml,title=\1 in \2,line=\3,col=\4::/g'
+ cat stderr.log | grep "in.*line.*column" -B1 -A1 --no-group-separator | sed -z 's/\([^\n]*\)\n\s*in "\([^"]*\)", line \([[:digit:]]\+\), column \([[:digit:]]\+\):\s*/::error file=dev-test-bootstrap2-iroh\/cloud-init.yaml,title=\1 in \2,line=\3,col=\4::/g'📝 Committable suggestion
‼️ IMPORTANT
Carefully review the code before committing. Ensure that it accurately replaces the highlighted code, contains no missing lines, and has no issues with indentation. Thoroughly test & benchmark the code to ensure it meets the requirements.
Suggested change
| cat stderr.log | grep "in.*line.*column" -B1 -A1 --no-group-separator | sed -z 's/\([^\n]*\)\n\s*in "\([^"]*\)", line \([[:digit:]]\+\), column \([[:digit:]]\+\):\s*/::error file=cloud-init.yaml,title=\1 in \2,line=\3,col=\4::/g' | |
| cat stderr.log | grep "in.*line.*column" -B1 -A1 --no-group-separator | sed -z 's/\([^\n]*\)\n\s*in "\([^"]*\)", line \([[:digit:]]\+\), column \([[:digit:]]\+\):\s*/::error file=dev-test-bootstrap2-iroh\/cloud-init.yaml,title=\1 in \2,line=\3,col=\4::/g' |
🤖 Prompt for AI Agents
Verify each finding against the current code and only fix it if needed.
In @.github/workflows/preview.yaml at line 29, The CI annotation is hardcoding
file=cloud-init.yaml in the sed replacement, preventing clickable diagnostics
for other files; update the sed replacement in the grep/sed pipeline (the
command that pipes stderr.log through grep and sed) to use the captured filename
group (\2) for the file= value and in the title if desired so the annotation
becomes file=\2,line=\3,col=\4 with the message/title using \1 and \2 as needed.
- Fix CI annotation file path for clickable diagnostics - Use systemctl enable --now to persist service across reboots - Increase certbot retry window with linear backoff (30 attempts) - Restart journald early to fix machine ID mismatch - Install podman in runcmd to ensure correct ordering
|
✔️ adf300b...6965f17 - Conventional commits check succeeded. |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
4 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
dev-test-bootstrap2-iroh)Summary by CodeRabbit
New Features
Documentation
Chores